T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/query.py:31
- Finding
- Phone Numbers and Persistent Device Identifiers Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/query.py:31` and `scripts/query.py:302-304` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: High ### Vulnerable Code ```python API_URL = "http://glm_autoclaw.tongxinsys.cn:8088/HMBJ/ApiShiGlmAutoClaw" ``` ```python url = "%s?%s" % (api, urllib.parse.urlencode({"sj": phone, "uid": state["uid"]})) try: data = http_get_json(url) ``` ### Technical Analysis The default API endpoint uses unencrypted HTTP. Each lookup transmits the queried phone number in the `sj` parameter and a persistent UUID in the `uid` parameter. These values are included directly in the URL query string. A phone number is sensitive personal data, while the persistent UID permits multiple queries from the same installation to be correlated. Plaintext HTTP provides neither transport confidentiality nor server-response integrity. Consequently: - Network observers can read the queried phone number and UID. - HTTP proxies, gateways, monitoring systems, and server access logs may retain the full query URL. - An on-path attacker can alter the returned JSON without detection. - Manipulated platform results can produce false risk classifications and unsafe call-handling advice. The remote service needs the phone number to perform the declared lookup, and the UID is documented as supporting quota tracking. Transmission is therefore related to the Skill's functionality. However, neither plaintext transport nor placement of these values in a URL is necessary. The endpoint can also be overridden through `PHONE_MARK_API_URL` without scheme or destination validation. This increases the risk of accidental or malicious redirection to an untrusted or insecure endpoint, although exploitation through that setting requires influence over the process environment. ### Attack Path 1. A user invokes the Skill with a mobile or landline number. 2. The script loads or generates a persistent device UID. 3. ...[truncated 1612 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the default endpoint with a trusted `https://` endpoint using a valid certificate. 2. Reject plaintext HTTP and unsupported URL schemes before sending any request. 3. Prefer an HTTPS `POST` request with a JSON body rather than placing phone numbers and UIDs in query strings. 4. If endpoint overrides are required, validate the configured hostname against an explicit allowlist. Otherwise, remove the override capability. 5. Ensure redirects cannot downgrade HTTPS to HTTP or redirect requests to untrusted hosts. 6. Apply strict response-schema validation, including expected field types and maximum response sizes. 7. Consider authenticated or signed responses if incorrect lookup results can materially affect user decisions. 8. Clearly disclose that phone numbers and a persistent identifier are sent to a third-party service, including the purpose, retention policy, and privacy implications. 9. Consider replacing the persistent UID with a shorter-lived or privacy-preserving quota token where operationally feasible. 10. Avoid logging complete request URLs or request bodies containing phone numbers, and configure the remote service and intermediaries to redact sensitive fields. ]]>